Merge pull request #304456 from MicrosoftDocs/main

learn-build-service-prod[bot] · web-flow · commit a4c979890bd0 · 2025-08-20T11:06:47.000Z
Auto Publish – main to live - 2025-08-20 11:00 UTC
diff --git a/articles/azure-app-configuration/TOC.yml b/articles/azure-app-configuration/TOC.yml
@@ -451,6 +451,10 @@
       items:
       - name: Feature flag telemetry reference
         href: feature-flag-telemetry-reference.md
+  - name: Local emulator
+    items:
+    - name: Overview
+      href: emulator-overview.md
   - name: Deployment
     items:
     - name: ARM template
diff --git a/articles/azure-app-configuration/configuration-provider-overview.md b/articles/azure-app-configuration/configuration-provider-overview.md
@@ -39,7 +39,7 @@ Module | Platform | Sample | Release Notes
 
 ## Feature Development Status
 
-This is an overview of each feature and its current status for different frameworks or programming languages.  
+This is an overview of each feature and its current status for different frameworks or programming languages. 
 
 - **GA (General Availability)**: The feature is fully released, considered stable, and ready for production use.  
 - **Preview**: The feature is available for early testing and feedback, but not yet fully stable or recommended for production use.  
diff --git a/articles/azure-app-configuration/emulator-overview.md b/articles/azure-app-configuration/emulator-overview.md
@@ -0,0 +1,132 @@
+---
+title: App Configuration Emulator Overview
+titleSuffix: Azure App Configuration
+description: Overview of Azure App Configuration emulator.
+services: azure-app-configuration
+author: zhiyuanliang-ms
+ms.author: zhiyuanliang
+ms.service: azure-app-configuration
+ms.topic: overview
+ms.date: 08/12/2025
+#Customer intent: I want to learn about how to Azure App Configuration emulator for local development.
+---
+
+# Azure App Configuration emulator overview
+
+The Azure App Configuration emulator is a local development tool that provides a lightweight implementation of the Azure App Configuration service. This emulator allows developers to test and develop applications locally without requiring an active Azure subscription or connection to the cloud service.
+
+The Azure App Configuration emulator is open source. For more information, visit the [GitHub repository](https://github.com/Azure/AppConfiguration-Emulator).
+
+## Feature overview
+
+The following table lists the features supported by the latest Azure App Configuration emulator.
+
+| Feature                                                          | Status    |
+| ---------------------------------------------------------------- | --------- |
+| Web UI                                                           | Available |
+| Anonymous Authentication                                         | Available |
+| [HMAC Authentication](./rest-api-authentication-hmac.md)         | Available |
+| [Entra Id Authentication](./rest-api-authentication-azure-ad.md) | WIP       |
+| .NET Aspire Integration                                          | WIP       |
+
+| API                                                              | Status    |
+| ---------------------------------------------------------------- | --------- |
+| [`/keys`](./rest-api-keys.md)                                    | Available |
+| [`/kv`](./rest-api-key-value.md)                                 | Available |
+| [`/labels`](./rest-api-labels.md)                                | Available |
+| [`/locks`](./rest-api-locks.md)                                  | Available |
+| [`/revisions`](./rest-api-revisions.md)                          | Available |
+| [`/snapshots`](./rest-api-snapshot.md)                           | WIP       |
+
+## Install the emulator
+
+### [Docker](#tab/docker)
+
+Use [Docker](https://hub.docker.com/) to pull the latest [App Configuration emulator image](https://mcr.microsoft.com/artifact/mar/azure-app-configuration/app-configuration-emulator/about) by using the following console command:
+
+```console
+docker pull mcr.microsoft.com/azure-app-configuration/app-configuration-emulator:1.0.0-preview
+```
+
+### [GitHub](#tab/github)
+
+This installation method requires that you have installed:
+* [Git](https://git-scm.com/)
+* [.NET 8.0 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
+* [Node.js](https://nodejs.org)
+
+1. Clone the [GitHub repository](https://github.com/Azure/AppConfiguration-Emulator) for the emulator project.
+
+    ```console
+    git clone https://github.com/Azure/AppConfiguration-Emulator.git
+    ```
+
+1. Build the entire solution including the UI components.
+
+    ```console
+    cd AppConfiguration-Emulator
+    dotnet restore
+    dotnet build
+    ```
+
+---
+
+## Run the emulator
+
+### [Docker](#tab/docker)
+
+The following command runs the App Configuration emulator Docker image. The `-p 8483:8483` parameter redirects requests from host machine's port 8483 to the Docker instance. The `-e Tenant:AnonymousAuthEnabled=true` and `-e Authentication:Anonymous:AnonymousUserRole=Owner` parameters configure the anonymous authentication for the emulator.
+
+```console
+docker run -d -p 8483:8483 \
+    -e Tenant:AnonymousAuthEnabled=true \
+    -e Authentication:Anonymous:AnonymousUserRole=Owner \
+    mcr.microsoft.com/azure-app-configuration/app-configuration-emulator:1.0.0-preview
+```
+
+If you want to have persisted data for the emulator, you can use a [bind mount](https://docs.docker.com/engine/storage/bind-mounts).
+
+```console
+docker run -d -p 8483:8483 \
+    -v "C:\aace:/app/.aace" \
+    -e Tenant:AnonymousAuthEnabled=true \
+    -e Authentication:Anonymous:AnonymousUserRole=Owner \
+    mcr.microsoft.com/azure-app-configuration/app-configuration-emulator:1.0.0-preview
+```
+
+### [GitHub](#tab/github)
+
+```console
+dotnet run --project src/Azure.AppConfiguration.Emulator.Host/Azure.AppConfiguration.Emulator.Host.csproj
+```
+
+---
+
+## Emulator in action
+
+Once started, the emulator is available at: `http://localhost:8483`
+
+1. Open your browser and navigate to `http://localhost:8483`.
+
+    > [!div class="mx-imgBorder"]
+    > ![Screenshot of the emulator UI with no key value.](./media/emulator/ui-empty.png)
+
+1. Click the `Create` button and add a new key `Message`.
+
+    > [!div class="mx-imgBorder"]
+    > ![Screenshot of the emulator UI, creating a new key value.](./media/emulator/ui-create.png)
+
+1. Click the `Save` button and you see the key value in the configuration explorer.
+
+    > [!div class="mx-imgBorder"]
+    > ![Screenshot of the emulator UI with the new key value.](./media/emulator/ui-updated.png)
+
+1. Get `http://localhost:8483/kv` and you get the following response.
+
+    ```json
+    {"items":[{"etag":"EzV9zWW8k5JpcIXL00T5Kg","key":"Message","label":null,"content_type":null,"value":"Hello World!","tags":{},"locked":false,"last_modified":"2025-08-12T16:56:25.384738+00:00"}]}
+    ```
+
+## Next steps
+
+For examples about how to use the emulator in your applications, go to the [GitHub repository](https://github.com/Azure/AppConfiguration-Emulator/tree/main/examples).
diff --git a/articles/azure-app-configuration/index.yml b/articles/azure-app-configuration/index.yml
@@ -222,6 +222,8 @@ landingContent:
           url: /rest/api/appconfiguration/
         - text: Data plane REST API
           url: rest-api.md
+        - text: Local emulator
+          url: emulator-overview.md
       - linkListType: reference
         links:
         - text: Azure CLI
diff --git a/articles/azure-app-configuration/media/emulator/ui-create.png b/articles/azure-app-configuration/media/emulator/ui-create.png
diff --git a/articles/azure-app-configuration/media/emulator/ui-empty.png b/articles/azure-app-configuration/media/emulator/ui-empty.png
diff --git a/articles/azure-app-configuration/media/emulator/ui-updated.png b/articles/azure-app-configuration/media/emulator/ui-updated.png
diff --git a/articles/backup/backup-azure-restore-key-secret.md b/articles/backup/backup-azure-restore-key-secret.md
@@ -1,31 +1,33 @@
 ---
-title: Restore Key Vault key & secret for encrypted VM
-description: Learn how to restore Key Vault key and secret in Azure Backup using PowerShell
+title: Restore Key Vault key & secret for encrypted Azure VM
+description: Learn how to restore Key Vault key and secret for encrypted VMs via Azure PowerShell using Azure Backup.
 ms.topic: how-to
 ms.custom: devx-track-azurepowershell
-ms.date: 09/04/2024
+ms.date: 08/20/2025
 author: AbhishekMallick-MS
 ms.author: v-mallicka
 # Customer intent: As a system administrator managing encrypted virtual machines, I want to restore keys and secrets to Azure Key Vault, so that I can successfully recover and create encrypted VMs from backup without losing data integrity and security.
 ---
 # Restore Key Vault key and secret for encrypted VMs using Azure Backup
 
-This article talks about using Azure VM Backup to perform restore of encrypted Azure VMs, if your key and secret don't exist in the key vault. These steps can also be used if you want to maintain a separate copy of the key (Key Encryption Key) and secret (BitLocker Encryption Key) for the restored VM.
+This article describes how to use Azure VM Backup to restore encrypted Azure Virtual Machines (VMs) when the original key and secret aren't available in the Key Vault. It's also applicable for scenarios where you want to maintain a separate copy of the key (Key Encryption Key) and secret (BitLocker Encryption Key) for the restored VM.
 
 [!INCLUDE [updated-for-az](~/reusable-content/ce-skilling/azure/includes/updated-for-az.md)]
 
 ## Prerequisites
 
-* **Backup encrypted VMs** - Encrypted Azure VMs have been backed up using Azure Backup. Refer to the article [Manage backup and restore of Azure VMs using PowerShell](backup-azure-vms-automation.md) for details about how to back up encrypted Azure VMs.
+Before you begin restoring an encrypted VM, ensure the following prerequisites are met:
+
+* **Backup encrypted VMs** - Encrypted Azure VMs are backed up using Azure Backup. Refer to the article [Manage backup and restore of Azure VMs using PowerShell](backup-azure-vms-automation.md) for details about how to back up encrypted Azure VMs.
 * **Configure Azure Key Vault** – Ensure that key vault to which keys and secrets need to be restored is already present. Refer to the article [Get Started with Azure Key Vault](/azure/key-vault/general/overview) for details about key vault management.
-* **Restore disk** - Ensure that you've triggered the restore job for restoring disks for encrypted VM using [PowerShell steps](backup-azure-vms-automation.md#restore-an-azure-vm). This is because this job generates a JSON file in your storage account containing keys and secrets for the encrypted VM to be restored.
+* **Restore disk** - Ensure that you trigger the restore job for restoring disks for encrypted VM using [PowerShell steps](backup-azure-vms-automation.md#restore-an-azure-vm) so that this job generates a JSON file in your storage account containing keys and secrets for the encrypted VM to be restored.
 
 ## Get key and secret from Azure Backup
 
 > [!NOTE]
-> Once disk has been restored for the encrypted VM, ensure that:
+> Once disk is restored for the encrypted VM, ensure that:
 >
-> * $details is populated with restore disk job details, as mentioned in [PowerShell steps in Restore the Disks section](backup-azure-vms-automation.md#restore-an-azure-vm)
+> * $details are populated with restore disk job details, as mentioned in [PowerShell steps in Restore the Disks section](backup-azure-vms-automation.md#restore-an-azure-vm)
 > * VM should be created from restored disks only **after key and secret is restored to key vault**.
 
 Query the restored disk properties for the job details.
@@ -48,7 +50,7 @@ $encryptionObject = Get-Content -Path $destination_path  | ConvertFrom-Json
 
 ## Restore key
 
-Once the JSON file is generated in the destination path mentioned above, generate key blob file from the JSON and feed it to restore key cmdlet to put the key (KEK) back in the key vault.
+Once the JSON file is generated in the mentioned destination path, generate key blob file from the JSON and feed it to restore key cmdlet to put the key (KEK) back in the key vault.
 
 ```powershell
 $keyDestination = 'C:\keyDetails.blob'
@@ -58,7 +60,7 @@ Restore-AzKeyVaultKey -VaultName '<target_key_vault_name>' -InputFile $keyDestin
 
 ## Restore secret
 
-Use the JSON file generated above to get secret name and value and feed it to set secret cmdlet to put the secret (BEK) back in the key vault. Use these cmdlets if your **VM is encrypted using BEK and KEK**.
+Use the generated JSON file to get secret name and value and feed it to set secret cmdlet to put the secret - BitLocker Encryption Key (BEK) back in the key vault. Use these cmdlets if your **VM is encrypted using BEK and KEK**.
 
 **Use these cmdlets if your Windows VM is encrypted using BEK and KEK.**
 
@@ -80,7 +82,7 @@ $Tags = @{'DiskEncryptionKeyEncryptionAlgorithm' = 'RSA-OAEP';'DiskEncryptionKey
 Set-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $Secret -ContentType  'Wrapped BEK' -Tags $Tags
 ```
 
-Use the JSON file generated above to get secret name and value and feed it to set secret cmdlet to put the secret (BEK) back in the key vault. Use these cmdlets if your **VM is encrypted using BEK** only.
+Use the generated JSON file to get secret name and value and feed it to set secret cmdlet to put the secret (BEK) back in the key vault. Use these cmdlets if your **VM is encrypted using BEK** only.
 
 ```powershell
 $secretDestination = 'C:\secret.blob'
@@ -97,11 +99,11 @@ Restore-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -InputFile $secret
 
 ## Create virtual machine from restored disk
 
-If you've backed up encrypted VM using Azure VM Backup, the PowerShell cmdlets mentioned above help you restore key and secret back to the key vault. After restoring them, refer to the article [Manage backup and restore of Azure VMs using PowerShell](backup-azure-vms-automation.md#create-a-vm-from-restored-disks) to create encrypted VMs from restored disk, key, and secret.
+If you back up encrypted VM using Azure VM Backup, the preceding PowerShell cmdlets help you restore key and secret back to the key vault. After restoring them, refer to the article [Manage backup and restore of Azure VMs using PowerShell](backup-azure-vms-automation.md#create-a-vm-from-restored-disks) to create encrypted VMs from restored disk, key, and secret.
 
 ## Legacy approach
 
-The approach mentioned above would work for all the recovery points. However, the older approach of getting key and secret information from recovery point, would be valid for recovery points older than July 11, 2017 for VMs encrypted using BEK and KEK. Once restore disk job is complete for encrypted VM using [PowerShell steps](backup-azure-vms-automation.md#restore-an-azure-vm), ensure that $rp is populated with a valid value.
+The preceding approach works for all the recovery points. However, the older approach of getting key and secret information from recovery point, would be valid for recovery points older than July 11, 2017 for VMs encrypted using BEK and KEK. Once restore disk job is complete for encrypted VM using [PowerShell steps](backup-azure-vms-automation.md#restore-an-azure-vm), ensure that $rp is populated with a valid value.
 
 ### Restore key (legacy approach)
 
diff --git a/articles/backup/backup-azure-vms-encryption.md b/articles/backup/backup-azure-vms-encryption.md
@@ -2,7 +2,7 @@
 title: Back up and restore encrypted Azure VMs
 description: Describes how to back up and restore encrypted Azure VMs with the Azure Backup service.
 ms.topic: how-to
-ms.date: 05/07/2025
+ms.date: 08/20/2025
 ms.service: azure-backup
 author: AbhishekMallick-MS
 ms.author: v-mallicka
@@ -214,3 +214,5 @@ If you run into any issues, review these articles:
 
 - [Common errors](backup-azure-vms-troubleshoot.md) when backing up and restoring encrypted Azure VMs.
 - [Azure VM agent/backup extension](backup-azure-troubleshoot-vm-backup-fails-snapshot-timeout.md) issues.
+- [Restore Key Vault key and secret for encrypted VMs using Azure Backup](backup-azure-restore-key-secret.md).
+
diff --git a/articles/backup/restore-azure-encrypted-virtual-machines.md b/articles/backup/restore-azure-encrypted-virtual-machines.md
@@ -2,7 +2,7 @@
 title: Restore encrypted Azure VMs
 description: Describes how to restore encrypted Azure VMs with the Azure Backup service.
 ms.topic: how-to
-ms.date: 06/23/2025
+ms.date: 08/20/2025
 author: AbhishekMallick-MS
 ms.author: v-mallicka
 # Customer intent: "As an IT administrator, I want to restore encrypted Azure virtual machines using the Azure Backup service, so that I can ensure data recovery while maintaining security compliance."
@@ -14,6 +14,8 @@ This article describes how to restore Windows or Linux Azure virtual machines (V
 > [!Note]
 > This article is applicable to virtual machines encrypted with Azure Disk encryption. For more information on ADE and how it differs from other disk encryption types in Azure, see [Disk Encryption Overview](/azure/virtual-machines/disk-encryption-overview).
 
+You can also restore Key Vault key and secret for encrypted VMs using Azure Backup. [Learn more](backup-azure-restore-key-secret.md).
+
 ## Before you start
 
 Review the known limitations before you start restore of an encrypted VM
diff --git a/articles/iot-hub/iot-hub-tls-support.md b/articles/iot-hub/iot-hub-tls-support.md
@@ -84,6 +84,9 @@ The following non-recommended cipher suites are allowed on hubs **without mi
 
 A client can suggest a list of higher cipher suites to use during `ClientHello`. However, IoT Hub might not support some of them, for example, `ECDHE-ECDSA-AES256-GCM-SHA384`. In this case, IoT Hub tries to follow the preference of the client but eventually negotiate down the cipher suite with `ServerHello`.
 
+> [!NOTE]
+> When using an ECDSA or ECDHE cipher, the client must provide the `supported_groups` extension in the `ClientHello` with a valid group. When connecting with a client certificate, the client must include the curve used in that client certificate in its `supported_groups` extension.
+
 ## Update IoT Hub to TLS 1.2 support
 
 Once an IoT Hub is created, the `minTlsVersion` property can be updated using the Azure portal, CLI, or SDKs. If you need to update to enforce IoT Hub to use TLS 1.2 and strong cipher suites (only allowed in selected regions) or to set TLS 1.2 support (supported in all regions), you can do so following these steps.
diff --git a/articles/service-connector/how-to-get-configurations.md b/articles/service-connector/how-to-get-configurations.md
@@ -5,16 +5,16 @@ author: maud-lv
 ms.author: malev
 ms.service: service-connector
 ms.topic: how-to
-ms.date: 07/04/2023
+ms.date: 08/20/2025
 ---
 
 # Get connection configurations added by Service Connector
 
 Service Connector configures connection information, such as Database connection string, while creating or updating service connections. After service connections are created, you might want to write code to consume these connection configurations in code. This page shows how to get connection configurations added by Service Connector. 
 
-There are multiple ways to get connection configurations of a service connection. You can get configuration names for specific target service type from the following articles [Integrate Azure Database for PostgreSQL with Service Connector](./how-to-integrate-postgres.md).
+There are multiple ways to get connection configurations of a service connection.
 
-Or you can get connection configurations programmatically in the following ways.
+You can get configuration names for specific target service type from the following articles [Integrate Azure Database for PostgreSQL with Service Connector](./how-to-integrate-postgres.md), or you can get connection configurations programmatically by running the following commands.
 
 ## [Azure CLI](#tab/azure-cli)
 You can run the following commands in Azure CLI(/cli/azure) to list configurations of a service connection.
@@ -31,7 +31,6 @@ az spring connection list-configuration --id /subscriptions/{subscription}/resou
 For more information, see the following articles in Azure CLI reference documentations:
 - [az webapp connection list-configuration](/cli/azure/webapp/connection#az-webapp-connection-list-configuration)
 - [az containerapp connection list-configuration](/cli/azure/containerapp/connection#az-containerapp-connection-list-configuration)
-- [az spring connection list-configuration](/cli/azure/spring/connection#az-spring-connection-list-configuration)
 
 ## [Azure PowerShell](#tab/azure-powershell)
 You can run the following commands in Azure PowerShell to list configurations of a service connection.
@@ -48,11 +47,9 @@ Get-AzServiceLinkerConfigurationForSpringCloud -ServiceName {mySpringAppName} -A
 For more information, see the following articles in Azure PowerShell reference documentations: 
 - [Get-AzServiceLinkerConfigurationForWebApp](/powershell/module/az.servicelinker/get-azservicelinkerconfigurationforwebapp)
 - [Get-AzServiceLinkerConfigurationForContainerApp](/powershell/module/az.servicelinker/get-azservicelinkerconfigurationforcontainerapp)
-- [Get-AzServiceLinkerConfigurationForSpringApp](/powershell/module/az.servicelinker/get-azservicelinkerconfigurationforspringcloud)
-
-
 
 ---
+
 ## Next steps
 > [!div class="nextstepaction"]
 > [Explore connection configurations for specific target service type](./how-to-integrate-sql-database.md)
